java-update.txt

rule carbanak_string
{
	meta:
		author = "MITRE Engenuity"
		date = "2/16/2021"
		description = "Used to detect strings associated with Carbanak"
	
    strings:
        $carbanak_string1 = "pashulke67@gmail.com"
		$carbanak_string2 = "Bargaining active"
		$carbanak_string3 = "200416180203Z"
		$carbanak_string4 = "www.bargaining-active.com"
		
    condition:
        all of them
}

rule dlls
{
	meta:
		author = "MITRE Engenuity"
		date = "2/16/2021"
		description = "Used to detect DLLs associated with Java-Update.exe"
	
    strings:
        $dlls1 = "kernel32.dll" nocase
		$dlls2 = "advapi32.dll" nocase
		$dlls3 = "ntdll.dll" nocase
		$dlls4 = "metsrv.dll" nocase
		$dlls5 = "WS2_32.dll" nocase
		$dlls6 = "CRYPT32.dll" nocase
		$dlls7 = "WININET.dll" nocase
		$dlls8 = "WINHTTP.dll" nocase
		$dlls9 = "USER32.dll" nocase
		$dlls10 = "ole32.dll" nocase
		$dlls11 = "msvcrt.dll" nocase

    condition:
        all of them
}

rule functions
{
	meta:
		author = "MITRE Engenuity"
		date = "2/16/2021"
		description = "Used to detect functions associated with Java-Update"
	
    strings:
		$functions1 = "AddMandatoryAce"
		$functions2 = "AdjustTokenPrivileges"
		$functions3 = "AllocateAndInitializeSid"
		$functions4 = "CertGetCertificateContextProperty"
		$functions5 = "CloseHandle"
		$functions6 = "CloseThreadpoolTimer"
		$functions7 = "CloseThreadpoolWait"
		$functions8 = "CoCreateGuid"
		$functions9 = "CommandAdded"
		$functions10 = "CompareStringEx"
		$functions11 = "ConnectNamedPipe"
		$functions12 = "CorExitProcess"
		$functions13 = "CreateEvent"
		$functions14 = "CreateFile"
		$functions15 = "CreateMutexA"
		$functions16 = "CreateNamedPipe"
		$functions17 = "CreateRemoteThread"
		$functions18 = "CreateSemaphoreExW"
		$functions19 = "CreateSymbolicLinkW"
		$functions20 = "CreateThread"
		$functions21 = "CreateToolhelp32Snapshot"
		$functions22 = "CryptAcquireContextA"
		$functions23 = "CryptDecodeObjectEx"
		$functions24 = "CryptDecrypt"
		$functions25 = "CryptDestroyKey"
		$functions26 = "CryptDuplicateKey"
		$functions27 = "CryptEncrypt"
		$functions28 = "CryptGenRandom"
		$functions29 = "CryptImportKey"
		$functions30 = "CryptImportPublicKeyInfo"
		$functions31 = "CryptReleaseContext"
		$functions32 = "CryptSetKeyParam"
		$functions33 = "CryptStringToBinaryA"
		$functions34 = "DecodePointer"
		$functions35 = "DeinitServerExtension"
		$functions36 = "DeleteCriticalSection"
		$functions37 = "DuplicateHandle"
		$functions38 = "EncodePointer"
		$functions39 = "EnterCriticalSection"
		$functions40 = "EnumSystemLocalesEx"
		$functions41 = "ExitProcess"
		$functions42 = "ExitThread"
		$functions43 = "FlsAlloc"
		$functions44 = "FlsFree"
		$functions45 = "FlsGetValue"
		$functions46 = "FlsSetValue"
		$functions47 = "FlushFileBuffers"
		$functions48 = "FlushInstructionCache"
		$functions49 = "FlushProcessWriteBuffers"
		$functions50 = "freeaddrinfo"
		$functions51 = "FreeEnvironmentStringsW"
		$functions52 = "FreeLibrary"
		$functions53 = "GetACP"
		$functions54 = "GetActiveWindow"
		$functions55 = "getaddrinfo"
		$functions56 = "GetCommandLineA"
		$functions57 = "GetComputerNameW"
		$functions58 = "GetConsoleCP"
		$functions59 = "GetConsoleMode"
		$functions60 = "GetCPInfo"
		$functions61 = "GetCurrent"
		$functions62 = "GetDateFormatEx"
		$functions63 = "GetEnvironmentStringsW"
		$functions64 = "GetExtensionName"
		$functions65 = "GetFileInformationByHandleExW"
		$functions66 = "GetFileSize"
		$functions67 = "GetFileType"
		$functions68 = "GetLastActivePopup"
		$functions69 = "GetLastError"
		$functions70 = "GetLocaleInfoEx"
		$functions71 = "GetLogicalProcessorInformation"
		$functions72 = "GetModule"
		$functions73 = "getnameinfo"
		$functions74 = "GetOEMCP"
		$functions75 = "GetOverlappedResult"
		$functions76 = "GetProcAddress"
		$functions77 = "GetProcessHeap"
		$functions78 = "GetProcessWindowStation"
		$functions79 = "GetStartupInfo"
		$functions80 = "GetStdHandle"
		$functions81 = "GetStringTypeW"
		$functions82 = "GetSystemDirectory"
		$functions83 = "GetSystemTime"
		$functions84 = "GetSystemTimeAsFileTime"
		$functions85 = "GetThreadDesktop"
		$functions86 = "GetThreadId"
		$functions87 = "GetTickCount"
		$functions88 = "GetTimeFormatEx"
		$functions89 = "GetUserDefaultLocaleName"
		$functions90 = "GetUserObjectInformationW"
		$functions91 = "GetVersionExA"
		$functions92 = "GetVolumeInformationW"
		$functions93 = "GlobalFree"
		$functions94 = "HeapAlloc"
		$functions95 = "HeapFree"
		$functions96 = "HeapReAlloc"
		$functions97 = "HeapSize"
		$functions98 = "HttpOpenRequestW"
		$functions99 = "HttpQueryInfoW"
		$functions100 = "HttpSendRequestW"
		$functions101 = "ImpersonateLoggedOnUser"
		$functions102 = "InitializeAcl"
		$functions103 = "InitializeCritical"
		$functions104 = "InitializeSecurityDescriptor"
		$functions105 = "InitServerExtension"
		$functions106 = "InternetCloseHandle"
		$functions107 = "InternetConnectW"
		$functions108 = "InternetCrackUrlW"
		$functions109 = "InternetOpenW"
		$functions110 = "InternetReadFile"
		$functions111 = "InternetSetOptionW"
		$functions112 = "IsDBCSLeadByteEx"
		$functions113 = "IsDebuggerPresent"
		$functions114 = "IsProcessorFeaturePresent"
		$functions115 = "IsValidCodePage"
		$functions116 = "IsValidLocaleName"
		$functions117 = "LCMapString"
		$functions118 = "LeaveCriticalSection"
		$functions119 = "LoadLibrary"
		$functions120 = "LocalAlloc"
		$functions121 = "LocalFree"
		$functions122 = "LookupPrivilegeValue"
		$functions123 = "MessageBoxW"
		$functions124 = "MultiByteToWideChar"
		$functions125 = "NtCreateSection"
		$functions126 = "NtLockVirtualMemory"
		$functions127 = "NtMapViewOfSection"
		$functions128 = "NtOpenFile"
		$functions129 = "NtOpenSection"
		$functions130 = "NtOpenThread"
		$functions131 = "NtQueryAttributesFile"
		$functions132 = "NtQueueApcThread"
		$functions133 = "OpenProcess"
		$functions134 = "OpenThread"
		$functions135 = "OutputDebugStringW"
		$functions136 = "PeekNamedPipe"
		$functions137 = "ProcessIdToSessionId"
		$functions138 = "QueryPerformanceCounter"
		$functions139 = "ReadFile"
		$functions140 = "ReflectiveLoader"
		$functions141 = "ReleaseMutex"
		$functions142 = "ResetEvent"
		$functions143 = "ResumeThread"
		$functions144 = "RtlAddFunctionTable"
		$functions145 = "RtlCaptureContext"
		$functions146 = "RtlCreateUserThread"
		$functions147 = "RtlLookupFunctionEntry"
		$functions148 = "RtlUnwindEx"
		$functions149 = "RtlVirtualUnwind"
		$functions150 = "SeDebugPrivilege"
		$functions151 = "SetDefaultDllDirectories"
		$functions152 = "SetEntriesInAclW"
		$functions153 = "SetEvent"
		$functions154 = "SetFileInformationByHandleW"
		$functions155 = "SetFilePointerEx"
		$functions156 = "SetHandleInformation"
		$functions157 = "SetLastError"
		$functions158 = "SetNamedPipeHandleState"
		$functions159 = "SetSecurityDescriptor"
		$functions160 = "SetStdHandle"
		$functions161 = "SetThread"
		$functions162 = "SetUnhandledExceptionFilter"
		$functions163 = "Sleep"
		$functions164 = "StagelessInit"
		$functions165 = "SuspendThread"
		$functions166 = "SystemTimeToFileTime"
		$functions167 = "TerminateProcess"
		$functions168 = "TerminateThread"
		$functions169 = "Thread32First"
		$functions170 = "Thread32Next"
		$functions171 = "TlsAlloc"
		$functions172 = "TlsFree"
		$functions173 = "TlsGetValue"
		$functions174 = "TlsSetValue"
		$functions175 = "UnhandledExceptionFilter"
		$functions176 = "VirtualAlloc"
		$functions177 = "VirtualFree"
		$functions178 = "VirtualProtect"
		$functions179 = "VirtualQuery"
		$functions180 = "WaitForMultipleObjects"
		$functions181 = "WaitForSingleObject"
		$functions182 = "WaitForThreadpoolTimerCallbacks"
		$functions183 = "WideCharToMultiByte"
		$functions184 = "WinHttp"
		$functions185 = "WriteConsoleW"
		$functions186 = "WriteFile"
		$functions187 = "WriteProcessMemory"
		$functions188 = "WSADuplicateSocketA"

    condition:
        all of them
}